Kind of hilarious, actually. cvs.com actually gets an A- on the test, as long as you don't look at the fact that it allows you to login over HTTP.
Please make the test smart enough to catch this insanity. Any site that also serves up content on HTTP should not get a passing grade. If you want to be precise, detect form fields in the page and only apply in that case, however I don't think it's worth the trouble. Just fail them all.
In any case, giving a site like this an A- rating is a joke. Please stop doing this.